1背景:
springboot项目中要求不能采用明文密码,故采用配置文件加密.
目前采用有密码的有redis nacos rabbitmq mysql 这些配置文件
2技术
2.1 redis nacos rabbitmq 配置文件加密
采用加密方式是jasypt 加密
2.1.1 加密步骤
2.1.2 引入maven依赖
<!-- 加密相关start -->
<dependency>
<groupId>com.github.ulisesbocchio</groupId>
<artifactId>jasypt-spring-boot-starter</artifactId>
<version>3.0.3</version>
</dependency>
<!-- 加密相关end -->
2.1.3 加注解@EnableEncryptableProperties
在启动类中加入@EnableEncryptableProperties
2.1.4 在配置文件中配置盐 加密方案
jasypt:
encryptor:
# 加密算法
algorithm: PBEWITHHMACSHA512ANDAES_256
# 加密使用的盐
password: jaspyt_password
2.1.5 编写测试类加密/解密密码
/**
* @author
* @description: 加密解密测试
*/
@SpringBootTest(classes = MycodeApplication.class)
@RunWith(SpringRunner.class)
@EnableEncryptableProperties
public class JasyptTest {
@Autowired
private StringEncryptor stringEncryptor;
/**
* 加密解密测试
*/
@Test
public void jasyptTest() {
// 加密
System.out.println(stringEncryptor.encrypt("nacos")); // JSrINYe4IBotHndGjX1hnmY3mtPNUJlXjP12cx1+pHqUz2FNXGPu3Frnajh3QCXg
// 解密
System.out.println(stringEncryptor.decrypt("0q/CVaDpjJ/kG7Je5Z2GjL99ahQvOxqjLXDHsDShkQIZlmnI7UWup7Sltd2N4cV7"));
// System.out.println(stringEncryptor.decrypt("rP4MtUODPjDz66wFfm20DR0y5YvWCI8bX1cKcoyPmEzPBZ7ylVJuyUAZL1dz7gfW")); // root
}
public static void main(String[] args) throws Exception{
/* String[] arr = ConfigTools.genKeyPair(512);
System.out.println("privateKey:"+arr[0]);
System.out.println("publicKey:"+arr[1]);
String publicKey ="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJByhUUvx4LNlBZFWDhyhaTRvy2J0W9QJ2XXccOJaCBPhUb9Af7UnyaYUra0pRvwlX1VqMCtM4n3du5IpXedAwcCAwEAAQ==";
String encryptStr = "XgBw9PoKkns4FP1oYIvLc7U+tjawEl8VWvSmcLYI5ekxUm0CoDa2saIB8ndQylo2jNXfqbYm6jz8Vzq7dOOpXg==";
System.out.println("encryptStr:"+encryptStr);
System.out.println("decryptStr:"+ConfigTools.decrypt(publicKey,encryptStr));*/
String privateKey ="MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAkHKFRS/Hgs2UFkVYOHKFpNG/LYnRb1AnZddxw4loIE+FRv0B/tSfJphStrSlG/CVfVWowK0zifd27kild50DBwIDAQABAkAn8kPA2nHGTqwBbLP1CFbFOeww38g3jGcY1vfzJ3DQXj/tf2fiBtiwzXQkB9c2+Z24XiXBo/fo3c1tTOxEtdHBAiEA9S+svZgwa1ZM2QpKmrkcXC5wdN/2FaptTWGOK0yjCp8CIQCW0W7QYwsbPcLKDTLLZ9iCDT6ckx3sl/ynnPeWc34WmQIgJ8x7T7M6eNHjW3+uKHtPvS7UlkQcX9vwLhVdzG1+MaUCIQCROnM+72DOhpaAAl2bSRBPi3lzRKdYILMGpDw2AFi2YQIhAO5eAxXQwe65AM2lVg+0C38rwMBvmyqU0ljnOLkRkL1t";
String encryptStr = ConfigTools.encrypt(privateKey,"Safm@987");
System.out.println(encryptStr);
String dbpassword = ConfigTools.decrypt("MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJByhUUvx4LNlBZFWDhyhaTRvy2J0W9QJ2XXccOJaCBPhUb9Af7UnyaYUra0pRvwlX1VqMCtM4n3du5IpXedAwcCAwEAAQ==", "XgBw9PoKkns4FP1oYIvLc7U+tjawEl8VWvSmcLYI5ekxUm0CoDa2saIB8ndQylo2jNXfqbYm6jz8Vzq7dOOpXg==");
System.out.println(dbpassword);
//System.out.println();
}
}
2.1.6 在用加密之后的秘钥替换要来的密码
注意要用ENC()包裹起来 注意要用ENC()包裹起来
注意要用ENC()包裹起来
server:
port: 9105
jasypt:
encryptor:
# 加密算法
algorithm: PBEWITHHMACSHA512ANDAES_256
# 加密使用的盐
password: jaspyt_password
spring:
mvc:
pathmatch:
matching-strategy: ant_path_matcher
main:
allow-circular-references: true
application:
name: dp-ccb
### cloud 相关配置
cloud:
nacos:
discovery:
server-addr: 172.0.0.1:8848
namespace: public
username: nacos
# 使用ENC()包裹,标识为加密之后的,否则无法解密,会报错
password: ENC(rP4MtUODPjDz66wFfm20DR0y5YvWCI8bX1cKcoyPmEzPBZ7ylVJuyUAZL1dz7gfW)
2.2 mysql 加密
驱动为DruidDataSource的方式上面的加密方式不能解析密码
加密方式为import com.alibaba.druid.filter.config.ConfigTools.decrypt
2.2.1 技术实现原理
在创建链接的时候注入密码解密器。
2.2.2 代码实现
自己实现DruidPasswordCallback 重写setProperties方法
package com.example.mycode.utils;
import com.alibaba.druid.filter.config.ConfigTools;
import com.alibaba.druid.util.DruidPasswordCallback;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.util.Properties;
/**
* @author sz
* @version 1.0
* @date 2023-02-13 21:07
*/
public class MyDataSourceCallback extends DruidPasswordCallback {
private static final Logger LOGGER = LoggerFactory.getLogger(MyDataSourceCallback.class);
@Override
public void setProperties(Properties properties) {
super.setProperties(properties);
String password = (String) properties.get("password");
String publickey = (String) properties.get("publickey");
if (StringUtils.isNotBlank(password)) {
try {
String dbpassword = ConfigTools.decrypt(publickey, password);
setPassword(dbpassword.toCharArray());
} catch (Exception e) {
LOGGER.error("Druid ConfigTools.decrypt", e);
}
}
}
}
2.2.3 用import com.alibaba.druid.filter.config.ConfigTools.decrypt 自带的加密,解密方式 加密密码
public static void main(String[] args) throws Exception{
String privateKey ="MIIBVQIBADANBgkqhkiG9w0BAQEFAASCAT8wggE7AgEAAkEAkHKFRS/Hgs2UFkVYOHKFpNG/LYnRb1AnZddxw4loIE+FRv0B/tSfJphStrSlG/CVfVWowK0zifd27kild50DBwIDAQABAkAn8kPA2nHGTqwBbLP1CFbFOeww38g3jGcY1vfzJ3DQXj/tf2fiBtiwzXQkB9c2+Z24XiXBo/fo3c1tTOxEtdHBAiEA9S+svZgwa1ZM2QpKmrkcXC5wdN/2FaptTWGOK0yjCp8CIQCW0W7QYwsbPcLKDTLLZ9iCDT6ckx3sl/ynnPeWc34WmQIgJ8x7T7M6eNHjW3+uKHtPvS7UlkQcX9vwLhVdzG1+MaUCIQCROnM+72DOhpaAAl2bSRBPi3lzRKdYILMGpDw2AFi2YQIhAO5eAxXQwe65AM2lVg+0C38rwMBvmyqU0ljnOLkRkL1t";
String encryptStr = ConfigTools.encrypt(privateKey,"123456");
System.out.println(encryptStr);
String dbpassword = ConfigTools.decrypt("MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJByhUUvx4LNlBZFWDhyhaTRvy2J0W9QJ2XXccOJaCBPhUb9Af7UnyaYUra0pRvwlX1VqMCtM4n3du5IpXedAwcCAwEAAQ==", "XgBw9PoKkns4FP1oYIvLc7U+tjawEl8VWvSmcLYI5ekxUm0CoDa2saIB8ndQylo2jNXfqbYm6jz8Vzq7dOOpXg==");
System.out.println(dbpassword);
//System.out.println();
}
2.2.4 在配置文件中配置信息
核心关键是配置connectionProperties 和passwordCallbackClassName
注意要connectionProperties 配置公钥和加密的密码
passwordCallbackClassName 要配置自定义的解密限定名
dataSources:
ds:
dataSourceClassName: com.alibaba.druid.pool.DruidDataSource
url: jdbc:mysql://172.27.15.74:3306/alter_table_test?serverTimezone=GMT%2B8&useUnicode=true&characterEncoding=UTF-8&useSSL=false&autoReconnect=true&failOverReadOnly=false&allowMultiQueries=true
username: root
password: XgBw9PoKkns4FP1oYIvLc7U+tjawEl8VWvSmcLYI5ekxUm0CoDa2saIB8ndQylo2jNXfqbYm6jz8Vzq7dOOpXg==
passwordCallbackClassName: com.example.mycode.utils.MyDataSourceCallback
connectionProperties: config:decrypt=true;publickey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJByhUUvx4LNlBZFWDhyhaTRvy2J0W9QJ2XXccOJaCBPhUb9Af7UnyaYUra0pRvwlX1VqMCtM4n3du5IpXedAwcCAwEAAQ==;password=XgBw9PoKkns4FP1oYIvLc7U+tjawEl8VWvSmcLYI5ekxUm0CoDa2saIB8ndQylo2jNXfqbYm6jz8Vzq7dOOpXg==
initial-size: 20
min-idle: 5
max-active: 50
max-wait: 60000
time-between-eviction-runs-millis: 60000
min-evictable-idle-time-millis: 300000
validation-query-timeout: 10000
test-while-idle: true
test-on-borrow: false
test-on-return: false
pool-prepared-statements: false
max-pool-prepared-statement-per-connection-size: 20